From 4463508f297f78c0478cf72959c651e4f66843b3 Mon Sep 17 00:00:00 2001
From: Admin Bot <admin@riotpiao.com>
Date: Sat, 5 Sep 2026 00:31:37 -0700
Subject: [PATCH] fix: sanitize JWT error to prevent JWKS URL leak in 403
 response

---
 internal/proxy/proxy.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/internal/proxy/proxy.go b/internal/proxy/proxy.go
index 045e79d..0ef4df3 100644
--- a/internal/proxy/proxy.go
+++ b/internal/proxy/proxy.go
@@ -323,7 +323,7 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 			writeProblemDetail(w, http.StatusForbidden,
 				"https://api.example.com/problems/forbidden",
 				"Forbidden",
-				fmt.Sprintf("JWT validation failed: %v", err),
+				"JWT validation failed",
 				nil)
 			logging.Errorf("auth failed", err, map[string]string{
 				"path": r.URL.Path,